mirror/guix
1
0
Fork 0
mirror of https://git.savannah.gnu.org/git/guix.git synced 2025-01-18 13:36:36 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

services: wireguard: Make the private-key field optional.

Browse source 
Users who retrieve the private-key via a PreUp field need to be able to
disable the default retrieval mechanism.

* gnu/services/vpn.scm (<wireguard-configuration>)[private-key]: Change
comment.
(wireguard-configuration-file): Conditionally serialize private-key.
* gnu/services/vpn.scm (wireguard-activation): Do not create private-key if
the field is #f.
* doc/guix.texi (VPN Services)[wireguard-configuration]: Document it.

Change-Id: Iac419809ae94eb76e97ff1f1749e2f4b3e65bb04
Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
This commit is contained in:
Richard Sent 2024-12-04 15:59:33 -05:00 committed by Mathieu Othacehe
parent d101a6275a
commit aa12068c91
No known key found for this signature in database
GPG key ID: 8354763531769CA6
2 changed files with 23 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
doc/guix.texi
View file

@ -34626,7 +34626,9 @@ an mcron time specification (@pxref{Guile Syntax,,,mcron}).
@item @code{private-key} (default: @code{"/etc/wireguard/private.key"})
The private key file for the interface. It is automatically generated
if the file does not exist.
if the file does not exist. If this field is @code{#f}, a private key
is not automatically created and the path is not serialized to the
configuration file.
@item @code{peers} (default: @code{'()})
The authorized peers on this interface. This is a list of

36
gnu/services/vpn.scm
View file

@ -741,7 +741,7 @@ (define-record-type* <wireguard-configuration>
(default '("10.0.0.1/32")))
(port wireguard-configuration-port ;integer
(default 51820))
(private-key wireguard-configuration-private-key ;string
(private-key wireguard-configuration-private-key ;maybe-string
(default "/etc/wireguard/private.key"))
(peers wireguard-configuration-peers ;list of <wiregard-peer>
(default '()))
@ -805,9 +805,12 @@ (define lines
#$@(if (null? pre-up)
'()
(list (format #f "~{PreUp = ~a~%~}" pre-up)))
(format #f "PostUp = ~a set %i private-key ~a\
~{ peer ~a preshared-key ~a~}" #$(file-append wireguard "/bin/wg")
#$private-key '#$peer-keys)
(if #$private-key
(format #f "PostUp = ~a set %i private-key ~a\
~{ peer ~a preshared-key ~a~}"
#$(file-append wireguard "/bin/wg")
#$private-key '#$peer-keys)
"")
#$@(if (null? post-up)
'()
(list (format #f "~{PostUp = ~a~%~}" post-up)))
@ -838,18 +841,19 @@ (define (wireguard-activation config)
(use-modules (guix build utils)
(ice-9 popen)
(ice-9 rdelim))
(mkdir-p (dirname #$private-key))
(unless (file-exists? #$private-key)
(let* ((pipe
(open-input-pipe (string-append
#$(file-append wireguard "/bin/wg")
" genkey")))
(key (read-line pipe)))
(call-with-output-file #$private-key
(lambda (port)
(display key port)))
(chmod #$private-key #o400)
(close-pipe pipe))))))
(when #$private-key
(mkdir-p (dirname #$private-key))
(unless (file-exists? #$private-key)
(let* ((pipe
(open-input-pipe (string-append
#$(file-append wireguard "/bin/wg")
" genkey")))
(key (read-line pipe)))
(call-with-output-file #$private-key
(lambda (port)
(display key port)))
(chmod #$private-key #o400)
(close-pipe pipe)))))))
;;; XXX: Copied from (guix scripts pack), changing define to define*.
(define-syntax-rule (define-with-source (variable args ...) body body* ...)